# Per-tenant Single Sign-On
URL: https://docs.autociso.io/release-notes/2026-08-single-sign-on/
Description: Connect your own identity provider — Google Workspace, Microsoft Entra ID, Okta or SAML 2.0 — and decide exactly which sign-in methods your organization offers.

## Per-tenant Single Sign-On

**Plans:** The Growth and above (Free and The Seed keep the built-in sign-in choices)
**Where:** **user menu → Organization Settings → Sign-In Policy**

Until now, "Sign in with Microsoft" meant signing in through *AutoCISO's*
Microsoft app. Your IT team had no control over it, your conditional-access
policies did not apply, and disabling someone in your directory did not stop
them reaching AutoCISO.

You can now connect your own identity provider instead.

### What's new

#### Bring your own identity provider

- Google Workspace, Microsoft Entra ID, Okta, generic OIDC and generic SAML 2.0
- You supply the client credentials; AutoCISO never stores your client secret
- A new connection starts as **Pending** and only becomes selectable after a
  successful **Test connection**
- The values to paste into your provider (Redirect URI, or ACS URL and Entity
  ID for SAML) are shown on the page, ready to copy

#### Allowed Providers now decides what people are offered

Previously this list rejected a disallowed provider *after* someone had
already signed in with it. It is now the sign-in policy itself: what you select
is what your people see. Select only your own provider and there is no password
field.

Removing **Email / Password** asks you to confirm, and AutoCISO refuses any
selection that would leave your organization with no way to sign in at all.

#### Your organization's sign-in link

A copyable `…/login/your-org` link that sends your team straight to your
identity provider, skipping the provider chooser. Share it or put it on your
intranet.

#### Automatic account creation

Optional, off by default. When on, anyone your identity provider authenticates
gets an account on first sign-in at a role you choose — Member, Contributor or
Auditor. Never Owner or Manager.

#### Email domains

Optionally restrict which email domains may sign in to your organization.
AutoCISO will not let you save a list that excludes an Owner, including
yourself.

#### Restore email & password sign-in

A one-press recovery action, available on **every** plan — including an expired
trial — and to any Owner. It can only add password sign-in back; it never
changes anything else. It exists so a billing state or a broken identity
provider can never trap you outside your own compliance evidence.

### Changes to existing behaviour

- **Every organization keeps password sign-in.** A one-time update ensures
  `Email / Password` is present in every organization's Allowed Providers before
  the new policy takes effect. Owners of any organization whose stored list did
  not include it were emailed.
- **Free and The Seed plans** keep the ability to choose among Email / Password,
  Google, GitHub and Microsoft. Connecting *your own* identity provider requires
  The Growth plan or higher. Nothing you had selected has changed.
- **System Managers** can view the Sign-In Policy page but no longer see write
  controls on it, matching what the server has always enforced.

### Not included yet

SCIM provisioning, group-to-role mapping, email-domain routing to a provider,
multiple connections per organization, and IdP-initiated SAML. See the
[Single Sign-On reference](https://docs.autociso.io/product/sso/overview/) for the full list and
what each one would change.